From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 909D83403F8 for ; Tue, 2 Jun 2026 07:18:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780384704; cv=none; b=o1Hcded8PzqVOLQpXsP2sCpGDdnxo+PB0JoESHJZ+VP5t/SXTxsNiMNbWkXA9DTSsBQjoQfzMVFGXECdkcCeH2iArgReP4I2sIsqHrSKnB0EEebxzSKVNx+1Ml+FpQqjcQlNdJrUq05vLtJa/XwI+gqk3CHuVEhN9y/QduWmEl0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780384704; c=relaxed/simple; bh=LaEl+yypMKeLK5rR8sTmYcYFF/hVieL3wAX2zHj57Fc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Z+A+WFLg6piu9QQWncY8Bik9WZUa+gDkv56vozLtudhKK9KdBgMnc6Xb3Ycyvw5oAvPbXDCsqOWHl/Sx+0lP/1lz2tYK9dXeQQ7tGGaG8orVdhGjwjXuz/b6L/7REH8uK+3BELjAwnegICA5KmT2t99QS3jW2hD1hmMK4TMeXtE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=lZhhK0eW; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=cNBHzPMy; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="lZhhK0eW"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="cNBHzPMy" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6522wm0t622454 for ; Tue, 2 Jun 2026 07:18:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=HU4ZtcghD0M 28On2VNhDRQP9LlC0xqJF34085t8tRAU=; b=lZhhK0eWBbNrvuuk9NZsrLbeJVC Fr2cHMY5Ev1KSDWse+dEPHqxxPOvyQo0NvHfUrNX0QfzkL3nvzxkhOwLyvgTF8VB ZJFBFKOIN9E/Kvg9WrkDKUJWaEADt4vnlhN0kI0ansOspTcJKSuz5BpUA3W+j9sF b+7BoRqAIRALrPocHNeE8LrMpN1AdvjTebCLOmavG+PQ0yO2Xks22cmtw4VrhMNT 6X1ndFN6N9zo+s5t12scC8B0vd9/24zKB0Sgea5eorKhnoXEHVk5gVW8P4M0Cjcq dZ+pgVK8A8fSFP4MGXs1KFgwlDZJkIs33KRVucojqkzO5BIMf0fb4sUNxmg== Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4eh954mkd2-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 02 Jun 2026 07:18:21 +0000 (GMT) Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-36bd4146cb2so4050210a91.1 for ; Tue, 02 Jun 2026 00:18:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1780384700; x=1780989500; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=HU4ZtcghD0M28On2VNhDRQP9LlC0xqJF34085t8tRAU=; b=cNBHzPMyEOCCDCbFcGwVA6AtNExEWHnd7bvT8m/sPoKYI1qqAnj/4K7ZJHZt4V8C9r 2LIf1OFDQDidEkTj8GzphH0kEZEn9PDiCEDx9sbvylm662u0GbhYby7nU8uFkq1eFQZE PIfEoXddDAJGC0x4Ryu9AvkO3/G+KvD7z9oVa62OGxaiTto8L/tm6biZANtdNKQVAn5n sL0hLKQHmkuK0JWUAm5AOofvj2atULks6jDIh86gXxXSatL32M7So+OB/4KAA/99lrH8 5I/DZSaje/Pyt+5gLRcRaU/owjqCdi0GdgBG/UISRh7ZrlbdRRAU47uNzzTr31v+QLwg xEww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780384700; x=1780989500; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=HU4ZtcghD0M28On2VNhDRQP9LlC0xqJF34085t8tRAU=; b=JzWDcAY6Vip/L4iLRItqWB2dyc7QDKKxyz8alskoDW+FwjXpwWHWDRqhQu1s4vfZmc DWVFllXKyJFOex2DVoLmSZguLqkQ6/911hfm9Dv+Op+EhxcpQT9l7aMiYC7HdvHhIRqQ scRVyUj6AqFSm9pR9PbUrx1S4u2VeSfGccgWO4p2nk6arPfVZBB72+26cazSz46aJ65A Ka+5ZPbRaD2UlqOe5ttH9xFjwm1gqG5jBUqZm9kTCjbz4IJ21wlcwlTqgljJVCAkYDAM Et/sL3EZNPYQwsT0P3amBlgPqJDm+H9JvYziHuFlxIGFY+jd92EsX/AqmFbT2v5fuJrr nWZw== X-Forwarded-Encrypted: i=1; AFNElJ8/b1g4kGAgvmjADk3qp9jg6CWypbUy5KWUTR6O9T2WMn4ofepqiis4BZevVLsitGaqEPA4SLtKROCJnkE=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1fP1O8sC1Ghv+ghRcTq4kq6z9Dlgo5//grnqhYOyPiHrs5uWF C3bm3u1VoWpv8CJ/0ASl82uZCIzxByLXbd7JkmYWOnLgnmP+d6fsSZkFz500CdWySlmS8Jt139s XZ/510v0loFgIycl9s65P9JZSJsSN/P7N5TUO1s574vETbH7trMlXoSlWfxMR4usm7Sg= X-Gm-Gg: Acq92OF1AqXAhRj/iPWLAMISJPCMOxGPx0/AhB37DxGL7EDO5sNZktL76pLlnJpusEP 1TTXuxVMW09ZZYEO92rfbj2MZ5BY/DImMFG1Mxq6PfTddJn3QxyYAS3i0I3iDVxi7Ms0Mrvi9Ob Eko3QivRnR89MySWxuwh0VnGZ9gibqQIB1j69uT7O02wPmjf5JgHaKETvoO0nI6UfTw8xTP/Inf 0BCC+Kwq9dN7JBlIjK0zcCzdg1KLL7Y3DUPhGtXufXBZDI+7VCODfynqYEKNJLPKjQKClu+z6JN 8z4BXq7XF8xHURnMYYPz780Al7odc17s2WdvOd2wrSOEaSt1HWNCnSpPPhlaHvtpCAZLESwGBpB 3qp6t7iWavFjC0/DMZVqHW7JeK8Cu2wxnDwC2YUebYbIpqS1ZDsSd3OHaa7W7ql0qvaHtKwysLT UizsnpOGqJK2qdIXlOwyvwLUe8yiEqbA== X-Received: by 2002:a17:90b:520a:b0:36b:a162:a1be with SMTP id 98e67ed59e1d1-36dd91f0f42mr2277831a91.4.1780384700329; Tue, 02 Jun 2026 00:18:20 -0700 (PDT) X-Received: by 2002:a17:90b:520a:b0:36b:a162:a1be with SMTP id 98e67ed59e1d1-36dd91f0f42mr2277800a91.4.1780384699782; Tue, 02 Jun 2026 00:18:19 -0700 (PDT) Received: from QCOM-SocCW5bzXR.qualcomm.com (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36dd91c9991sm1766279a91.7.2026.06.02.00.18.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 00:18:19 -0700 (PDT) From: Jianping Li To: srini@kernel.org, amahesh@qti.qualcomm.com, arnd@arndb.de, gregkh@linuxfoundation.org, abelvesa@kernel.org, jorge.ramirez@oss.qualcomm.com Cc: Jianping Li , linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, ekansh.gupta@oss.qualcomm.com, quic_chennak@quicinc.com, stable@kernel.org Subject: [PATCH v7 4/5] misc: fastrpc: Allocate entire reserved memory for Audio PD in probe Date: Tue, 2 Jun 2026 15:17:49 +0800 Message-Id: <20260602071750.526-5-jianping.li@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260602071750.526-1-jianping.li@oss.qualcomm.com> References: <20260602071750.526-1-jianping.li@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-ORIG-GUID: kMmlyMknggpnAP8pZ9ZgPHXE_nks25Ja X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjAyMDA2NiBTYWx0ZWRfX27dO/+vVIq35 MTYz/9QN6dCSxI7HM5QRH4Y1P+Ra1cETxPxoU77ZrqsXJLw/ulBof3i3Eyd7xV8QWZzcbhTaqoM ODEClqIjyLJihjjJA+sBjOnrVKavWP7cRlj0urq3Gf/72jguHX4r1Iy7LUTHsuLjmeCJEO88dUF BqPBIZLlaiAq6a6Y2d7fIKWWcla+KakvKfn93O4FjrH78QF10DRkUgFhOrnV7NPwe7GelRRXYah sJv+276hPoZT/zUH9E/KlUxWIJUHTpuBG5K1mimI3vZvDqg0d21sg55AGJtVBNJTZtKiRk99JC/ qOZh4rVjVFZaJgXrgqCeZj+RY1DhEi0pLqlwPDzn4aLx6CmQyFbIGQen2om7cbId5UqpymaLxGx IIOco5P6djeFz86JFueBfklaUzUNUoNYyqMaWaX1OLsqAkknO0/QFujCIIyru33ZRGAcE4F7TXX zn6HttD/hZhWeyZAorA== X-Proofpoint-GUID: kMmlyMknggpnAP8pZ9ZgPHXE_nks25Ja X-Authority-Analysis: v=2.4 cv=VpcTxe2n c=1 sm=1 tr=0 ts=6a1e83bd cx=c_pps a=vVfyC5vLCtgYJKYeQD43oA==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=vXPY0jRleWu_0xqwLycA:9 a=rl5im9kqc5Lf4LNbBjHf:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-01_07,2026-05-28_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 suspectscore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 phishscore=0 adultscore=0 priorityscore=1501 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2606020066 Allocating and freeing Audio PD memory from userspace is unsafe because the kernel cannot reliably determine when the DSP has finished using the memory. Userspace may free buffers while they are still in use by the DSP, and remote free requests cannot be safely trusted. Additionally, the current implementation allows userspace to repeatedly grow the Audio PD heap, but does not support shrinking it. This can lead to unbounded memory usage over time, effectively causing a memory leak. Fix this by allocating the entire Audio PD reserved-memory region during rpmsg probe and tying its lifetime to the rpmsg channel. This removes userspace-controlled alloc/free and ensures that memory is reclaimed only when the DSP process is torn down. Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd") Cc: stable@kernel.org Signed-off-by: Jianping Li --- drivers/misc/fastrpc.c | 96 +++++++++++++++++++----------------------- 1 file changed, 43 insertions(+), 53 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index f46a8f53970d..33be8bed6a0b 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -276,6 +276,8 @@ struct fastrpc_channel_ctx { struct kref refcount; /* Flag if dsp attributes are cached */ bool valid_attributes; + /* Flag if audio PD init mem was allocated */ + bool audio_init_mem; u32 dsp_attributes[FASTRPC_MAX_DSP_ATTRIBUTES]; struct fastrpc_device *secure_fdevice; struct fastrpc_device *fdevice; @@ -1344,15 +1346,16 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, struct fastrpc_init_create_static init; struct fastrpc_invoke_args *args; struct fastrpc_phy_page pages[1]; + struct fastrpc_channel_ctx *cctx = fl->cctx; char *name; int err; - bool scm_done = false; struct { int client_id; u32 namelen; u32 pageslen; } inbuf; u32 sc; + unsigned long flags; if (!fl->cctx->remote_heap || !fl->cctx->remote_heap->dma_addr || @@ -1383,31 +1386,6 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, inbuf.client_id = fl->client_id; inbuf.namelen = init.namelen; inbuf.pageslen = 0; - if (!fl->cctx->remote_heap) { - err = fastrpc_remote_heap_alloc(fl, fl->sctx->dev, init.memlen, - &fl->cctx->remote_heap); - if (err) - goto err_name; - - /* Map if we have any heap VMIDs associated with this ADSP Static Process. */ - if (fl->cctx->vmcount) { - u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); - - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, - fl->cctx->vmperms, fl->cctx->vmcount); - if (err) { - dev_err(fl->sctx->dev, - "Failed to assign memory with dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, - fl->cctx->remote_heap->size, err); - goto err_map; - } - scm_done = true; - inbuf.pageslen = 1; - } - } fl->pd = USER_PD; @@ -1419,8 +1397,17 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, args[1].length = inbuf.namelen; args[1].fd = -1; - pages[0].addr = fl->cctx->remote_heap->dma_addr; - pages[0].size = fl->cctx->remote_heap->size; + spin_lock_irqsave(&cctx->lock, flags); + if (!fl->cctx->audio_init_mem) { + pages[0].addr = fl->cctx->remote_heap->dma_addr; + pages[0].size = fl->cctx->remote_heap->size; + fl->cctx->audio_init_mem = true; + inbuf.pageslen = 1; + } else { + pages[0].addr = 0; + pages[0].size = 0; + } + spin_unlock_irqrestore(&cctx->lock, flags); args[2].ptr = (u64)(uintptr_t) pages; args[2].length = sizeof(*pages); @@ -1438,27 +1425,7 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl, return 0; err_invoke: - if (fl->cctx->vmcount && scm_done) { - u64 src_perms = 0; - struct qcom_scm_vmperm dst_perms; - u32 i; - - for (i = 0; i < fl->cctx->vmcount; i++) - src_perms |= BIT(fl->cctx->vmperms[i].vmid); - - dst_perms.vmid = QCOM_SCM_VMID_HLOS; - dst_perms.perm = QCOM_SCM_PERM_RWX; - err = qcom_scm_assign_mem(fl->cctx->remote_heap->dma_addr, - (u64)fl->cctx->remote_heap->size, - &src_perms, &dst_perms, 1); - if (err) - dev_err(fl->sctx->dev, "Failed to assign memory dma_addr %pad size 0x%llx err %d\n", - &fl->cctx->remote_heap->dma_addr, fl->cctx->remote_heap->size, err); - } -err_map: - fastrpc_buf_free(fl->cctx->remote_heap); - fl->cctx->remote_heap = NULL; -err_name: + fl->cctx->audio_init_mem = false; kfree(name); err: kfree(args); @@ -2425,12 +2392,21 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) } } - if (domain_id == SDSP_DOMAIN_ID) { + if (domain_id == SDSP_DOMAIN_ID || domain_id == ADSP_DOMAIN_ID) { struct resource res; u64 src_perms; err = of_reserved_mem_region_to_resource(rdev->of_node, 0, &res); if (!err) { + if (domain_id == ADSP_DOMAIN_ID) { + data->remote_heap = + kzalloc_obj(*data->remote_heap, GFP_KERNEL); + if (!data->remote_heap) + return -ENOMEM; + + data->remote_heap->dma_addr = res.start; + data->remote_heap->size = resource_size(&res); + } src_perms = BIT(QCOM_SCM_VMID_HLOS); err = qcom_scm_assign_mem(res.start, resource_size(&res), &src_perms, @@ -2438,7 +2414,6 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) if (err) goto err_free_data; } - } secure_dsp = !(of_property_read_bool(rdev->of_node, "qcom,non-secure-domain")); @@ -2519,6 +2494,7 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) struct fastrpc_buf *buf, *b; struct fastrpc_user *user; unsigned long flags; + int err; /* No invocations past this point */ spin_lock_irqsave(&cctx->lock, flags); @@ -2536,8 +2512,22 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) list_for_each_entry_safe(buf, b, &cctx->invoke_interrupted_mmaps, node) list_del(&buf->node); - if (cctx->remote_heap) - fastrpc_buf_free(cctx->remote_heap); + if (cctx->remote_heap && cctx->vmcount) { + u64 src_perms = 0; + struct qcom_scm_vmperm dst_perms; + + for (u32 i = 0; i < cctx->vmcount; i++) + src_perms |= BIT(cctx->vmperms[i].vmid); + + dst_perms.vmid = QCOM_SCM_VMID_HLOS; + dst_perms.perm = QCOM_SCM_PERM_RWX; + + err = qcom_scm_assign_mem(cctx->remote_heap->dma_addr, + cctx->remote_heap->size, &src_perms, + &dst_perms, 1); + if (!err) + kfree(cctx->remote_heap); + } of_platform_depopulate(&rpdev->dev); -- 2.43.0